# prevent-window-opener-attacks

> Prevent window.opener attacks for _blank links

Latest version **0.3.1** (published 2023-04-11) · MIT license · 0 weekly downloads

> **Deprecated.** This package is deprecated.

## Install

```sh
npm install prevent-window-opener-attacks
pnpm add prevent-window-opener-attacks
yarn add prevent-window-opener-attacks
bun add prevent-window-opener-attacks
```

## Health

**Score 10/100 (F)** — status: deprecated.

Negative: deprecated.

## Facts

| | |
|---|---|
| Version | 0.3.1 |
| Published | 2023-04-11 |
| First published | 2017-11-08 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 0 |
| Unpacked size | 19 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 9 |
| Author | Merkle Inc. |
| Maintainers | merkleorg, namicsorg, ernscht, tamara027, zidizei, danielkochde, tsailer, dienele |
| Keywords | window.opener, opener, attack |

## Links

- npm: https://www.npmjs.com/package/prevent-window-opener-attacks
- Repository: https://github.com/merkle-open/prevent-window-opener-attacks
- Homepage: https://github.com/merkle-open/prevent-window-opener-attacks#readme
- Issues: https://github.com/merkle-open/prevent-window-opener-attacks/issues
- npm.io page: https://npm.io/package/prevent-window-opener-attacks

## Recent versions

- 0.3.1 (latest) — 2023-04-11
- 0.3.0 — 2021-08-24
- 0.2.5 — 2020-05-19
- 0.2.4 — 2018-02-27
- 0.2.3 — 2018-02-27
- 0.2.1 — 2017-11-10
- 0.2.0 — 2017-11-10
- 0.1.0 — 2017-11-08

## README

# prevent-window-opener-attacks

[![NPM version][npm-image]][npm-url]
[![Size][size-image]][size-url]
[![License][license-image]][license-url]

This extreme tiny script will prevent the default behaviour of a click on an a-tag with `taget="_blank"`, open the link using `window.open` and ensure that `window.opener = null`.

## Examples

[Example without fix](https://merkle-open.github.io/prevent-window-opener-attacks/example/entry-without-fix.html)

[Example with fix](https://merkle-open.github.io/prevent-window-opener-attacks/example/entry-with-fix.html)

## Fix it with the rel attribute

You are able to set the `rel="noreferrer noopener"` attribute on an a-tag. This will also prevent to call `window.opener` on the location page. But this will only handle simple links.

```html
<a href="http://example.com" target="_blank" rel="noreferrer noopener">Click me!</a>
```

## Test your own site

Copy the following code in your dev-tools on your webpage and click on the generated link on the bottom of your page. If your page redirect after clicking the generated link, you will need this fix.

```js
(() => {
  const a = document.createElement('a');
  a.href =
    'https://merkle-open.github.io/prevent-window-opener-attacks/example/evil-page.html';
  a.target = '_blank';
  a.innerHTML = 'Click me!';
  document.body.appendChild(a);
})();
```

## Usage

### ES Modules

Fixes the attack vector on document ready automatically

```js
import('prevent-window-opener-attacks');
```

### CommonJS & AMDJS

Fixes the attack vector on document ready automatically

```js
require('prevent-window-opener-attacks');
```

### ES Modules - direct call

Allows to call the fix explicitely

```js
import { preventWindowOpenerAttacks } from 'prevent-window-opener-attacks/src/lib';
preventWindowOpenerAttacks();
```

### CommonJS - direct call

Allows to call the fix explicitely

```js
const {
  preventWindowOpenerAttacks,
} = require('prevent-window-opener-attacks/dist/lib.js');
preventWindowOpenerAttacks();
```

### AMD JS - direct call

Allows to call the fix explicitely

```js
require('prevent-window-opener-attacks/dist/lib.js', function ({
  preventWindowOpenerAttacks,
}) {
  preventWindowOpenerAttacks();
});
```

[npm-image]: https://badge.fury.io/js/prevent-window-opener-attacks.svg
[npm-url]: https://npmjs.org/package/prevent-window-opener-attacks
[license-image]: https://img.shields.io/badge/license-MIT-green.svg
[license-url]: https://opensource.org/licenses/MIT
[size-image]: https://img.badgesize.io/merkle-open/prevent-window-opener-attacks/master/dist/auto.min.js.svg?compression=gzip&label=gzip%20size
[size-url]: https://unpkg.com/prevent-window-opener-attacks/dist/auto.min.js

---
_Source: https://npm.io/package/prevent-window-opener-attacks · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._